What does Windows 10 security allow and what can you strengthen?

Most vendors including Microsoft recommend that organizations take a proactive approach to risk management and proactively enhance their security layers. As a primary way to protect endpoints, the vendor recommends adopting a least privilege policy: "All users should be able to log into an account with the minimum level of privileges, so they can work seamlessly within their tasks without compromising application security."
 
Is migrating to Windows 10 enough to reduce the risk of the threat? It won't.
The known vulnerabilities of Windows 7 systems, which were due to, among other things, the fact that the system was not aligned with modern threat protection standards (vulnerability to WannaCry/WannaCrypt attacks) prompted a swift response from Microsoft in the form of the latest version of Windows 10. The new version of the software includes several additional, separate security products that are installed separately to enhance protection, and require appropriate access rights. One of these is the Advanced Threat Protection (ATP) functionality integrated into Windows Defender. You can test ATP by selecting this link: https://www.microsoft.com/en-us/windowsforbusiness/windows-atp
 
Windows Defender: your own bodyguard that you don't pay for.
The ATP mechanism, is much more extensive than a standard antivirus system to provide protection for end devices. Even so, it is not a guarantee of security. It is good practice to support this mechanism with additional mechanisms that examine the behavior of the process itself and the resources it invokes. This makes it possible to detect more vulnerabilities, including unknown ones, especially in the case of exploit attacks (remote execution of malicious code). According to one report prepared after the 2017 BlackHat conference, 73% hackers point to antivirus systems as one of the weakest links in operating systems - often outdated and out of date, failing to effectively protect against cyber attacks. It is also a weakness of such systems that they only work after an infection and can't cope with functions triggered from Power Shell.
 
With the release of Windows 10, Microsoft released Device Guard. This is an improved version of the Applocker solution, which was supposed to filter apps and, after verification, allow their use on end devices. The effectiveness of Applocker depended on security departments to keep their lists of trusted apps up-to-date and take care of
for a software update. Unfortunately, the application did not have the ability to build custom exclusion lists (Blacklisting).
 
Device Guard is a stronger version of Applocker: hardware-integrated, it is more resistant to vulnerabilities, while much more difficult to manage
and configuration. Perfect security does not exist. So how to deal with
With current problems?
 
Solution: Apply the principles of limited access (and trust).
One of the most effective ways to prevent data leaks
from end devices is to implement the most important overarching security policy - the principle of least privilege.
By doing so, you significantly reduce the risk of unknown code execution, including malware, suspicious processes or network infiltration by removing access rights that allow end devices to act as an administrator.
 
ISCG advises:
Migrating to Windows 10 is the first step to improve security on endpoint devices and, in the process, overhaul systems, applications and permission levels.
 
ISCG recommends:
1 Make a list of all the applications used in your company. Check that all licenses are in use, that they are actually needed and up to date.
2 Create policies to manage licenses. Make sure that license management privileges are assigned only to specific users with Administrator rights.
3. remove random and often hidden administrator privileges from end devices. This will strengthen your protection against unauthorized modifications to the system or applications.
4 Create security "checklists" - include aspects such as policy management tools (including Active Directory), secure testing rules (sandboxing) or application testing and reporting.
5 Apply the principle of least privilege. Set appropriate levels and priorities for application access so that a given team in the organization can use it safely and smoothly
 
Do you need support? Fill out the form below for a free consultation with an ISCG expert and learn how to increase your security comfort.